URL authentication is more like a hack for the moment, due to emberjs/ember.js#1773 being still undecided. The truth is, I haven't got over to try it in a full app environment yet, so I think you have got a bug where these params are still visible. I'd go for a fix to remove auth token from the URL properly once the sign in attempt has been fired.

Getting auth token from header is good too, but if the above is fixed, would you still want this feature?

On a side note, I have not worked with oAuth much yet, but from what I know, it calls your callback URL after the sign in attempt, is that right? I was thinking whether it should be better handling the remember me with this PR, or providing a method for setting it - and expect userland code to call this method on route entry.